Thread by @BenDoBrown

I captured five days of tweets using #WestPapua & #FreeWestPapua tags after a crackdown by Indonesian forces against Papuans in Aug. What I found was a bot network spreading pro-govt propaganda.

Follow this thread for an #OSINT journey with a @Twitter network analysis
👇👇👇

This is a representation of all of the twitter activity I captured. The dots are the nodes which are accounts. The lines between them are retweets, mentions or likes. I have used the open source visualiser @Gephi to illustrate this network & to conduct 'bot-spotting' 🤖

How does this help? With this visualisation we can spot irregularities. Just like a moth in a web, we notice this far-removed cluster of accounts over to the left, with a very unnatural network pattern. This thread will look at WHO they are, WHAT they do, and HOW they run.

With this unnatural network spotted, I want to know WHO they are. I have the labels in Gephi for the nodes as the account names, so I can start searching Twitter for these curious characters.

Meet @marco26700420. He’s a pro-government bot that only uses a mix of West Papuan hashtags such as #Westpapuagenocide #Freewestpapua & #Westpapua

A simple Yandex image reverse search on @marco26700420’s profile picture leads us a little further down the rabbit hole - we can see it is not a genuine account.

Next up, let’s check out @kevinma40204275 who is also in the network. The Yandex test fails him too. Another non-genuine Twitter account.

Another bot account caught in the web is @yerxi1. Yandex image reverse search prevails. Remember that these accounts were only caught after five days, the actual size of this bot network is much larger 🤖🤖🤖

It’s obvious the above accounts are fake. Where’s the harm? The harm is that they are, on scale, pushing pro-government content shifting problem of what’s happening in West Papua, & promoting Indonesian government activities in the area. Video in posts: imgur.com/a/HyPMbjX)

What about the referral accounts in this network? Let’s take a look at @PapuaWestcom. It has a standalone website for its propaganda material, a @YouTube channel w/ 703 subs, & @facebook page with 56k followers.

Another account @West_Papua_ID, has more reach. Its @YouTube acc has 846 subs, @facebook 152k, @instagram 10.3k. A number of accounts in this network are using variations of West Papua & ID in their names. But let’s dig into some of @West_Papua_ID posts a bit more.

On @YouTube, the channel uses videos to provide its own narrative. On @facebook the content labels the freedom movement as as the “Free Papua extremist group” and claim they are the cause of the violence.

The WestPapuaid @instagram account with 10.3k followers gives the same pro-government material as what we have seen on @Twitter, Facebook and YouTube. I ran an @Instagram audit (igaudit.io) to see estimate of real followers. The account has 34% real followers.

Okay, I have taken you through the WHO, and the WHAT. But HOW do we know they’re bots. Well they’re sharing the same content using the same text and follow each other in a vacuum environment void of human activity. How else can we tell it’s a robot? Well, bots run on routines.

Do the accounts in this network have routines? Let's look at their action time. For a bot network, the only task they do is post or retweet at given times. I used Twint (Python script on @github: github.com/twintproject/t…) & ran it on two accounts to pull their data to look closer

The two accounts I chose from this network to cross-reference for bot-spotting were @kevinma40204275 and @bellanow1. The command I used on Twint was: sudo twint -u bellanow1 --media -o papuabots1 --csv. I repeated that for Kevin. Here’s what I got.

I only want to see the times of the two @Twitter accounts & when they posted. On any given day there are set patterns the bots work on. It’s automated but still runs on a programmed pattern. You can see that in the pattern of post times with B on the left, and K on the right.

What have we found with this visualisation? An active bot network is attempting to distort oppression on West Papuans. Despite reports from human rights & news bodies, the network is disseminating content through @Twitter, @facebook, @YouTube & @instagram to distort the truth.

H/T to @hpiedcoq for pearls of csv wisdom & to @fs0c131y for his superb work on #GiletsJaunes tag which inspired me to step inside the node/edge world. Thanks for following. If you’d like to follow more, check out full post on @Bellingcat here: bellingcat.com/news/2019/09/0…
✌️

@hpiedcoq @fs0c131y @bellingcat UPDATE - Bots be dead! Thank you for the overwhelming response to the thread and work I have done. You have all helped make a stand against a propaganda machine working to distort the news about #WestPapua. @Twitter has suspended many of the accounts identified in the network.

@hpiedcoq @fs0c131y @bellingcat @Twitter This pro-Indonesian Government bot network is also using @Facebook ads to target European countries with propaganda videos and infographics using the #Freewestpapua & #Westpapuagenocide tags - here's a continuation of an #OSINT thread of analysis into FB Ads & disinformation

First, how did I find the @facebook pages? The propaganda bots we got suspended by @Twitter (above) had standalone websites. These linked to all of their social accounts. This website, for instance, was linked from suspended account @West_Papua_ID

For pages like this, @Facebook introduced a ‘transparency’ feature in April 2018 so that we can look into the WHO, WHERE and WHEN of this '#WestPapua' Facebook page to answer our questions

For this @Facebook page, we can tell that the majority of the page managers are primarily from #Indonesia and that it was registered on August 14 2018. All three Facebook pages analysed were made on the same day, and have the same number of ‘managers’.

That’s not all. We can also see if these pages ran ads, how long for, how much they spent, and possible targeted locations. First, let’s look at what they ran. Note: many of the ads were ran under tags about papua, including #WestPapuaGenocide and #FreeWestPapua

Interestingly a lot of the ads from all three pages were advertising pro-Indonesian Government propaganda about West Papua to @facebook users in The #Netherlands, while other posts in #Germany, UK & other areas. While the ad rate was low (less than €100), it was a unique point.

With @Twitter’s suspension of the pro-Indonesian Govt bots spreading disinformation shown in this thread, I hope @Facebook either suspends the pages, or stops their advertising & disinformation (poke @ErinSaltman). Here’s the full report on @Medium: medium.com/@benjamindbrow… ✌️

A big H/T to @febrofirdaus who just translated the posts above to Indonesian. The posts are how this pro-Government disinformation campaign uses Facebook ads to target people in Europe about #WestPapua - main areas are the Netherlands, Germany & UK👇

https://twitter.com/febrofirdaus/status/1172013635821920256?s=21

@febrofirdaus Another sock puppet 🤖🧦 on the radar from suspended acc @4freewestpapua. It was made on same day as the others (14.8.18), ran by same 31 Indonesian managers, uses same @facebook ad plan & currently running ads using #westpapuagenocide tag: ads here: facebook.com/ads/library/?a…